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Abstract 

We define solution concepts appropriate for computationally bounded players playing a fixed 
finite game. To do so, we need to define what it means for a computational game, which is a 
sequence of games that get larger in some appropriate sense, to represent a single finite un¬ 
derlying extensive-form game. Roughly speaking, we require all the games in the sequence to 
have essentially the same structure as the underlying game, except that two histories that are 
indistinguishable (i.e., in the same information set) in the underlying game may correspond to 
histories that are only computationally indistinguishable in the computational game. We define 
a computational version of both Nash equilibrium and sequential equilibrium for computational 
games, and show that every Nash (resp., sequential) equilibrium in the underlying game corre¬ 
sponds to a computational Nash (resp., sequential) equilibrium in the computational game. One 
advantage of our approach is that if a cryptographic protocol represents an abstract game, then 
we can analyze its strategic behavior in the abstract game, and thus separate the cryptographic 
analysis of the protocol from the strategic analysis. 


1 Introduction 

Game-theoretic models assume that the players are completely rational. This is typically interpreted 
as saying that payers act optimally given (their beliefs about) other players’ behavior. However, 
as was first pointed out by Simon [14] , acting optimally may be hard. Thus, there has been a 
great deal of interest in capturing bounded rationality, and finding solution concepts appropriate 
for resource-bounded players. 

One explanation of bounded rationality is that players have limits on their computational 
power. For example, the players might be able to use only strategies that can be implemented 
by a polynomial-time TM. While there has been a great deal of work on solving 

game-theoretic problems using computationally bounded players, there has not really been a careful 
study of the solution concepts appropriate for such players. What does it mean, for example, to 
say that a fixed finite game played by polynomial-time players has a Nash equilibrium? 

Consider for example the following two-player extensive-form game G: At the the empty history, 
player 1 secretly chooses one of two alternatives and puts her choice inside a sealed envelope. Player 

2 then also chooses one of these two alternatives. Finally, player 1 can either open the envelope 
and reveal her choice or destroy the envelope. If she opens the envelope and she chose a different 
alternative than player 2, player 1 wins and gets a utility of 1; otherwise (i.e., if player 1 either 
chose the same alternative as player 2 or she destroyed the envelope) player 1 loses and gets a 
utility of —1. Player’s 2’s utility is the opposite of player I’s. The game tree for this game is given 
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Figure 1: A game that can be represented by a computational game. 

in Figure[^ Since player 2 acts without knowing I’s choice, the two histories where 1 made different 
choices are in the same information set of player 2. 

Resource-bounded players can implement this game even without access to envelopes, using 
what is called a commitment scheme. A commitment scheme is a two-phase two-party protocol 
involving a sender (player 1 above) and a receiver (player 2). The sender sends the receiver a 
message in the first phase that commits him to a bit without giving the receiver information about 
the bit (at least no information that he can efficiently compute from the message); this is the 
computational analogue of putting the bit in an envelope. In the second phase, the sender “opens 
the envelope” by sending the receiver some information that allows the receiver to confirm what bit 
the sender committed to in the first phase. Thus, we can talk about a game G (actually a sequence 
of games as discussed later) where instead of player 1 using an abstract envelope to send her choice 
to player 2, she uses a commitment scheme to do so. 

Intuitively, we would like to say that the two games represent the same underlying game. 
However, there are many subtleties in doing so. To get a sense of the problems, note that to 
use commitment schemes we need the players to be computationally bounded. But to talk about 
computation bounds (for instance, polynomial-time TMs), we need to have a sequence of inputs 
that can grow as a function of n. So how do we proceed if we want to talk about computationally 
bounded players in a fixed finite game? The idea is that we will have a sequence of games, potentially 
increasing in size, that represents the single game. As we shall see, the information structure of 
the games in the infinite sequence might differ from that of the underlying game. For example, in 
the games described before, while a commitment scheme gives no information to a computationally 
bounded player, an unbounded player has complete information; the encrypted string uniquely 
identifies the bit that was committed. Thus, unlike in G, commitments to different bits in Q are in 
different information sets for player 2. 

Additional complications arise when we consider solution concepts for such games. Traditional 
notions of equilibrium involve all players making a best response. But if we restrict to computation¬ 
ally bounded players, there may not be a best response, especially for the kinds of cryptographic 
problems that we would like to consider. For example, for every polynomial-time TM, there may 
be another TM that does a little better by spending a little longer trying to do decryption. (See 

for an example of this phenomenon.) Moreover, when considering sequentially rational solution 
concepts it is unclear what information structure should be considered since, as we discussed, the in¬ 
formation structure of the computational games does not capture the knowledge of computationally 
bounded players. 


2 



Our contributions. As a first step to capturing these notions, in Section 3.1, we define what 
it means for a sequence Q = {Gi,G 2 , ■ ■ ■) of games to represent a single game G. Intuitively, all 
the games in the sequence G have the same basic strncture as G, but might use increasingly longer 
strings to represent actions in G (e.g., an action a in G might be represented in Gn by an encryption 
of a that uses a security parameter of length n) . More precisely, we require a mapping from histories 
in the games Gn to histories in G, as well as a mapping from strategies in G to strategies in Q, and 
impose what we argue are reasonable conditions on these mappings Q In Section 3.2 we show how 
this definition play ont in the example discussed above. 

As hinted before, our conditions do not force the games in G to have the same information 
structure as G. While two histories in the same information set in Gn mnst map to two histories in 
the same information set in G, it may also be the case that two histories in different information 
sets in Gn are mapped to the same information set in G. Althongh a player can distinguish two 
histories in different information sets (for example a commitment to 0 and a commitment to 1 in 
the example are two different strings), at a compntational level, she cannot tell them apart. The 
encodings just look like random strings to her. There is a sense in which she, as a computationally 
bounded player, does not understand the “meaning” of these histories (althongh a computationally 
nnbounded player could break the commitment and tell them apart). In Section 3.3, we make this 


intuition precise, showing that our requirements force all histories that map to the same information 
set in G to be computationally indistinguishable, even if they are in different information sets in G- 
Once we have dehned our model of computational games, we focus on dehning analognes of 


two solntion concepts, Nash equilibrium (NE) and sequential eqnilibrium. In Section 4.1, we dehne 


a computational analogues of NE, which considers only deviations that can be implemented by 
polynomial-time TMs. It handles previously mentioned complications by allowing for the strategy 
to be an e best response for some negligible function e. (Our definition of NE is similar in spirit 
to the dehnition in Dodis, Halevi, and Rabin [^.) We show that if a strategy prohle is a NE in 
the underlying game G, then there is a corresponding strategy profile of polynomial time TMs 
that is a computational NE in G- Thus, we provide conditions that guarantee the existence of a 
computational NE, addressing an open question of Katz 
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In Section 4.2, we define a computational analogue of sequential eqnilibrinm. It is notoriously 
problematic to define sequentially rational solntion concepts in cryptographic protocols. For exam¬ 
ple, Gradwohl, Livne, and Rosen provide a general discussion of the issue, and give a partial 
solution in terms of avoiding what they call “empty threats”, which applies only to two-player 
games of perfect information, and discnss possible extensions. Our notion of compntational sequen¬ 
tial equilibrium, which is quite different in spirit from the solntion concept of Gradwohl, Livne, and 
Rosen (and arguably conceptually much simpler and much closer in spirit to the standard game- 
theoretic definition), applies to arbitrary sequence of games that represent a finite game, and uses 
the intuitions we develop on the connection between information sets in the nnderlying finite game 
and computational indistinguishability in the sequence. We again show that if a strategy profile is 
a sequential eqnilibrium in the underlying game G, then there is a corresponding strategy prohle 
of polynomial time TMs that is a compntational sequential eqnilibrium in G- 

An important beneht of our approach is that it separates the game-theoretic analysis from the 
cryptographic analysis. We can view the sequence G as an implementation of an abstract game 
G. Given this view, we can hrst prove that a protocol is a good implementation of an abstract 
game, and then analyze the strategic aspects in that simple abstract game. For example, to show 
a prescribed cryptographic protocol is a Nash (resp., sequential) equilibrium, we can hrst show 
it represents an abstract ideal game; it then suffices to show that the protocol corresponds to 


^The idea of games that depends on a security parameter goes back to Dodis, Halevi, and Rabin [^. Hubacek 
and Park also consider a mapping between histories in a computational game and histories in an abstract game, 
although they do not consider the questions in the same generality that we do here. 
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a strategy profile that is a Nash (resp., sequential) equilibrium in the much simpler underlying 
game. We give an exmaple of this idea in Section where we show how our approach can be used 
to analyze a protocol for implementing a correlated equilibrium (CE) without a mediator using 
cryptography, in the spirit of the work of Dodis, Halevy, and Rabin [^. 

2 Preliminaries 

2.1 Extensive-form games 

We begin by reviewing the formal definition of an extensive-form game . A finite extensive-form 
game G is a tuple ([c], H, P, u,I) satisfying the following conditions: 

• [c] = { 1 ,..., c} is the set of players in the game. 

• H is a set of history sequences that satishes the following two properties: 

— the empty sequence () is a member of H ; 

— if (ai,..., ax) £ H and L < K then (oi,..., a^) G H. The elements of a history h are 
called actions. 

A history (ai,..., a^) £ H is terminal if there is no a such that (a^,..., a^, a) G H. The set 
of actions available after a nonterminal history h is denoted A(h) = {a : h ■ a) G H} (where 
h - ■■ a is the result of concatenating a to the end of Let denote the set of terminal 
histories, let denote H \ H^, and let denote the histories after which player i plays. 

• P : H \ —>■ [c]. P{h) specihes the player that moves at history h. 

• u : Ht —>■ specifies for each terminal history the utility of the players at that history {ui{h) 

is the utility of player i at terminal history h). 

• for each player i £ [c], Xj is a partition of iL* with the property that A(h) = A{h') whenever 
h and h' are in the same member of the partition. For I G Xj, we denote by A{I) the set A{h) 
for h £ I (recall that A{h) = A{h') if h and h' are two histories in I). We assume without loss 
of generality that if / 7 ^ then A{I) and A{I') are disjoint (we can always rename actions 
to ensure that this is the case). We call Xj the information partition of player i] a set I £ li 
is an information set of player X = (Xi,... ,Xc) is the information partition structure of the 
game. A game of perfect information is one where all the information sets are singletons. 

This model can capture situations in which players forget what they knew earlier. Roughly 
speaking, a game has perfect recall if the information structure is such that the players remember 
everything they knew in the past. 

Definition 2.1. Let EXPi{h) he the record of player i’s experience in history h, that is, all the 
actions he plays and all the information sets he encounters in the history. A game has perfect recall 
if, for each player i, we have EXPi{h) = EXPi{h') whenever the histories h and h' are in the same 
information set for player i. 

A deterministic strategy s for player i is a function from Xj to actions, where for I £ Xi, we 
require that s{I) £ A(I). We also consider mixed strategies which are probability distribution over 
deterministic strategies. A profile of strategies a = {ai,... ,cJc} induces a distribution denoted pg 

^For technical convenience, we assume that |A(/i)| > 2 for all histories h. If this is not the case, then that step of 
the game is not interesting, and can essentially be removed. 
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on terminal histories. We say that a strategy prohle is completely mixed if pg assigns positive prob¬ 
ability to every history h G . The expected value of player i given a is then Pa{h)ui{h). 

We use the standard notation x-i to denote the vector x with its ith element removed and 
{x',x-i) to denote x with its ith element replaced by x'. 

Definition 2.2 (Nash Equilibrium), a = {ui,..., Uc} is an e-Nash equilibrium (NE) of G if, for 
all players i G [c] and for all strategies a' for player i, 


^ pg{h)ui{h)> ^ p„,^g_^{h)ui{h) - e. 

h&HT heHT 


We now recall the notion of sequential equilibrium [11] , A sequential equilibrium is a pair [a, p) 
consisting of a strategy profile a and a belief system p, where p associates with each information 
set I a probability p{I) on the nodes in I. Intuitively, if I is an information set for player i, p{I) 
describes z’s beliefs about the likelihood of being in each of the nodes in I. Then {a, p) is a sequential 
equilibrium if, for each player i and each information set I for player i, Uj is a best response to 
given i’s beliefs p{I). An equivalent definition that does not require beliefs and is more suitable for 
our setting is given by the following theorem; 


Theorem 2.3. 11 Proposition 6 ] Let G he an extensive-form game with perfect recall. There 


exists a belief system p such that [a, p) is a sequential equilibrium of G iff there exists a sequenee of 
completely mixed strategy profiles ... eonverging to a and a sequence 61 , 62 , ■■ ■ of nonnegative 

real numbers converging to 0 such that, for each player i and each information set I for player i, 
is a 6 n-best response to eonditional on having reached I. 


a. 


2.2 Computational indistinguishability 

For a probabilistic algorithm A and an infinite bitstring r, A{x‘,r) denotes the output of A running 
on input x with randomness r; A(x) denotes the distribution on outputs of A induced by considering 
A{x',r), where r is chosen uniformly at random. A function e : N —>• [0,1] is negligible if, for every 
constant c G N, €{k) < k~^ for sufficiently large k. 

Definition 2.4. A probability ensemble is a sequence X = of probability distribution 

indexed by N. (Typically, in an ensemble X = the support of Xn consists of strings of 

length n.) 

We now recall the definition of computational indistinguishability [^. 

Definition 2.5. Two probability ensembles are computationally indistinguish¬ 

able if, for all PPT TMs D, there exists a negligible function e such that, for all n G N, 

I Pr[D(l”, Xn) = 1] - Pr[D(r, W) = 1]| < e(n). 

To explain the Pr in the last line, recall that Xn and Yn are probability distributions. Although we 
write D{Y,Xn), D is a randomized algorithm, so what D{Y,Xn) returns depends on the outcome 
of random eoin tosses. To be a little more formal, we should write D{Y,Xn,r), where r is an 
infinitely long random bit strong (of whieh D will only use a finite initial prefix). More formally, 
taking Prx„ to be the joint distribution over strings {x,r), where x is chosen according to Xn and 
r is chosen aecording to the uniform distribution on bit-strings, we want 

[{(a;, r) : D{Y, x, r) = 1}] - Pry„ [{(?/, r) : D{Y, y, r) = 1}] | < e(n). 

We similarly abuse notation elsewhere in writing Pr. 

We often call a TM M that is supposed to distinguish between two probability ensembles a 
distinguisher. 
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2.3 Commitment schemes 


We now define a cryptographic commitment scheme that will be used in our examples. Informally, 
such a scheme is a two-phase two-party protocol for a sender and a receiver. In the first phase, 
the sender sends a message to the receiver that commits the sender to a bit without giving the 
receiver any information about that bit; in the second phase, the sender reveals the bit to which 
he committed in a way that guarantees that this really is the bit he committed to. 

Definition 2.6. A secure commitment scheme with perfect bindings is a pair of PPT algorithms 
C and R such that: 

• C takes as input a security parameter , a bit b, and a bitstring r, and outputs 
C{l^,b,r),C 2 {l^,b,r), where Ci{l^,b,r), called the commitment string, is a k-bit string, and 
(172(1^,6,r), called the commitment key, is a {k — l)-bit string. We use C{l^,b) to denote the 
output distribution of algorithm C{l^,h,r) when r is chosen uniformly at random. 

• R is a deterministic algorithm that gets as input two strings c and s and outputs o G {0,1, /}. 

• (Hiding) {Ci(l^, 0)}fc6N {^1(1^, l)}fcgN computationally indistinguishable. 

• (Perfect binding) R{Ci{l^,b,r), {C2{1^,b,r)) = bforallk andr; moreover, if s ^ C 2 {l^,b,r), 
then R{Ci{l^, b, r)), s) ^ {0,1}. 

Cryptographers typically assume that secure commitment schemes with perfect bindings exist. 
(Their existence would follow from the existence of one-way permutations] see for further dis¬ 
cussion and formal definitions.) 

3 Computational Extensive-Form Games 

3.1 Definitions 

Statements of computational difficulty typically say that there is no (possibly randomized) 
polynomial-time algorithm for solving a problem. To make sense of this, we need to consider, 
not just one input, but a sequence of inputs, getting progressively larger. Similarly, to make sense 
of computational games, we cannot consider a single game, but rather must consider a sequence of 
games that grow in size. The games in the sequence share the same basic structure. This means 
that, among other things, they involve the same set of players, playing in the same order, with 
corresponding utility functions. To make this precise, we first start with a more general notion, 
which we call a computable uniform sequence of games. 

Definition 3.1. A computable uniform sequence Q = {Gi,G2 ,...} of games is a sequence that 
satisfies the following conditions: 

• All the games in the sequence involve the same set of players. 

• Let Hn be the set of histories in Gn. There exists a polynomial p such that, for all nonterminal 
histories h G H(^'^, A{h) C {0, H In addition, there is a PPT algorithm that, on input 
1” and a history h, determines whether h G Hn. 

• There exists a polynomial-time computable function P' from [j((Li{Hn'^) to [c]. The function 
Pn in game Gn € G is then P' restricted to Hn^. 

^{0,denotes the language consisting of bitstrings of length at most p{n). 
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• For each player i, there exists a polynomial-time computable function Ui : —>■ M such 

that the utility function of player i in game Gn is Ui restricted to . 

We sometimes call a computable uniform sequence of games a computational game. 

Computable uniform sequences of games already suffice to allow us to talk about polynomial¬ 
time strategies. A strategy M for player z in a computable uniform sequence Q = (Gi, G 2 , ...) is a 
probabilistic TM that takes as input a pair {W,v), where u is a view for player i in Gn (discussed 
below), and outputs an action in A{I). We assume that the TMs are stateful] they have a tape 
on which the random bits used in previous rounds are recorded. The view of a stateful TM M 
for player i in Gn is a tuple {vj, r) , where vj is the representation of information set I and r 
contains the randomness that has been used thus far (so is nondecreasing from round to round). 
This can be viewed as having perfect recall of randomness, as the TMs are not allowed to “forget” 
the randomness they used. It is considered part of their experience so far in the same way as the 
actions that they played and the information sets that they visited]^ 

We next define what it means for a uniform sequence G = {Gi, G 2 , ■ ■ ■) of games to represent 
an underlying game G. To explain different aspects of this definition, it is useful to go back to the 
example in the introduction and discuss what it means for a sequence G to represent the game G in 
Figure As discussed before, we can implement this game using a commitment scheme. The point 
is that now we get, not one game, but a sequence of games, one for each choice of security parameter. 
Rather that putting a bit b in an envelope, in Gn player 1 sends Gi{W,b). More precisely, he sends 
Ci(l"', b, r), for a string r chosen chosen uniformly at random. To then open the envelope, player 1 
can just send ^ 2 ( 1 "', b, r) and any other string to destroy it. 

Roughly speaking, we want all the games in G to have the same “structure” as G. We formalize 
this by requiring a surjective mapping /„ from histories in each game Gn in the sequence to histories 
in G. Note that fn is not, in general, one-to-one. There may be many histories in Gn representing 
a single history in G. This can already be seen in our example; each of the histories in Gn where 
player 1 sends Gi(l’^, l,r) get mapped to the history in G where player 1 puts 1 in an envelope. 
Moreover, although Ci(l"^,0,r) and C'i(l",l,r) get mapped to histories in the same information 
set in G, they are not in the same information set in Gn] an exponential-time player can break 
the encryption and tell that they correspond to different bits being put in the envelope. Thus, the 
mapping fn does not completely preserve the information structure. We require that h and /n(h) 
have the same length (same number of actions). Of course, the utility associated with a terminal 
history h in Gn is the same as that associated with history fn{h) in G. 

The first three conditions below capture the relatively straightforward structural requirements 
above. The final requirement imposes conditions on the players’ strategies, and is somewhat more 
complicated. Informally, the fourth requirement is that there is a mapping T from strategies in 
G to strategies in G, where F{a) “corresponds” to a in some appropriate sense. But what should 
“correspond” mean? Let M be a strategy profile for G- For each game Gn € G, M induces a 
distribution denoted on the terminal histories in Gn- By applying fn, we can push this forward 

to a distribution on the terminal histories in G. A mixed strategy profile a in G also induces 
a distribution on the terminal histories in G, denoted pg. 

Definition 3.2. A strategy profile 0 corresponds to M if {(p'^}ni=n is statistically close to {/OalneN-' 
that is, if are the terminal histories of G, then there exists a negligible function e such that, for 

This assumption is equivalent to allowing the TM to have an additional tape on which it can save an arbitrary 
state. For any TM M that does this, there is an equivalent TM M' that has no additional tape, but simply reconstructs 
M’s state by simulating M’s computation from scratch using its view. This suffices, for example, to reconstruct a 
secret key that was generated in the first round, so it can be used in later rounds. 
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So one requirement we will have is that, for all strategy prohles ct in G, a corresponds to 
{T{ai),... ,T{an)), which we abbreviate as In addition, we require that the strategy profile 

J-{a) “knows” which underlying action it plays. We formalize this by requiring that, for strategy a 
in the underlying game, there is a TM that, given view v for player i in outputs the action 
in G corresponding to the action played by given view v. 

Finally, we require a partial converse to the correspondence requirement. It is clearly too much 
to expect a full converse. Q has a richer structure than G; it allows for more ways for the players 
to coordinate than G. So we cannot expect every strategy profile in Q to correspond to a strategy 
profile in G. Thus, we require only that strategies in a rather restricted class of strategy profiles 
in Q correspond to a strategy in G: namely, ones where we start with a strategy of the form J-{a) 
(which, by assumption, corresponds to it), and allow one player to deviate. We must also use a 
weaker notion of correspondence here. For example, in the game in Figure even if we start with 
a strategy of the form F{a), the deviating strategy M[ could be such that player 1 commits to 0 
in Gn for n even, and commits to 1 in G„ for n odd. The strategy prohle (M{,T'(ct 2 )) does not 
correspond to any strategy profile in G. Thus, the notion of correspondence that we consider in 
this case is that if i plays M( rather that T{ai), then there exists a sequence a[, cr^,... of strategies 
in G, rather that a single strategy a', and require only that the sequence .pjneN be 

computationally indistinguishable from {palneN) rather than being statistically close. 

Definition 3.3. A computable uniform sequence Q = {Gi, G 2 ,...} represents an underlying game 
G if the following conditions hold: 

UGl. G and every game in Q involve the same set of players. 

UG2. For each game Gn G Q, there exists a surjective mapping fn from the histories in Gn to the 
histories in G such that 

(a) \h\ = \fn{h)\; 

(b) the same player moves in h and fn{h); 

(c) if h' is a subhistory of h, then fn{h') is a subhistory of fn{h); 

(d) if h and h' are in the same information set in Gn, then fn{h) o,nd fn{bl) are in the same 
information set in G; 

(e) for h ^ H (a history of G), let LA{h) denote the last action played in h; if h and h' are 
in the same information set in Gn, then for any a such that h\\a G Hn, LA{fn{h\\a)) = 
LA{fn{h'\\a)) (where || is the concatenation operator). 

UG3. If h is a terminal history of Gn, then the utility of each player i is the same in h and fn{h). 

UGf. There is a mapping T from strategies in G to strategies in Q sueh that 

(a) for all strategy profiles a in G, a corresponds to F{a) = (T'(cri),... ,F[an)); 

(b) for each strategy a for player i in G, there exists a polynomial-time TM that, given 

as input 1"' and a view v for player i in Gn that is reachable when player i plays F{ai) 

in Gn, returns an aetion for player i sueh that LA{fn{F{a){l^,v,rT))) = u, r^), 

where vt is the random tape used (remember that the view contains the randomness used 


(c) for all strategy profiles a in G, all players i, and all polynomial-time strategies M' for 
player i in Q, there exists a sequence . of strategies for player i in G such that 

computationally indistinguishable from {p^/ g ,)}n- 


Definition 


3.3 


requires the existence of a sequence / = (/i, /2 ...) in UG2 and a function iF in 
UG4. When we want to refer specifically to / and F, we say that G (/, J^)-represents G. 

Note that UG2 requires that if h and h' are in the same information set in Gn, then /n(h) and 
fn{h') must be in the same information set in G. This means that we can view /„ as a map from 
information sets to information sets. However, it does not require the converse. As discussed above, 
in an exponential-time player may be able to make distinctions between histories that cannot be 
made of the corresponding histories in the underlying game. We would like to be able to say that a 
polynomial-time player cannot distinguish h and h' if /n(h) and fn{h') are in the same information 
set. As we show later, these conditions allow us to make such a claim. 

Also note that since the game is finite, to show UG4(a) and UG4(b) hold, it is enough to 
prove they hold for deterministic strategies. Given a mapping F that satisfies UG4(a) and (b) for 
deterministic strategies, we can extend it to mixed strategies in the obvious way: since a mixed 
strategy is just a probability distribution over finitely many deterministic strategies, it can be 
implemented by a TM that plays that probability distribution up to negligible precision over the 
corresponding mapping of the deterministic strategies (such an approximating distribution can be 
easily constructed in polynomial time). It is obvious that UG4(a) still holds. UG4(b) holds since 
using V and ry, we can reconstruct which deterministic strategy o' in the support of a was actually 
used to reach v, and then use the corresponding TM . 


3.2 The commitment game as a uniform computable sequence 

We now consider how these definitions play out in the game G in Figure and the sequence 
G = {Gi, G 2 , ■ ■ ■) described above where player 1 uses a commitment scheme as an envelope. 

Lemma 3.4. G represents G. 

Proof. First, we show that ^ is a computable uniform sequence. All the games in the sequence 
involve exactly 2 players; the set of histories in Gn is a subset of {0,1}-"", and it is easy to compute 
the next player to act; finally, the utility functions are polynomial-time computable by using the 
TM R of the commitment scheme. 

Next we show that the sequence represents G. There is an obvious mapping from histories of 
the games in the sequence to histories of G: a commitment to 0 is mapped to 0, a commitment to 
1 is mapped to 1, the action of player 2 is just mapped to the action in G, player 1 providing the 
right key is mapped to action “open”, and player 1 providing a wrong key is mapped to “destroy”. 
Finally, it is easy to verify that UG3 (the condition on utilities) holds. 

To show that UG4 holds, we need to define a function F. A strategy for player 2 in G can’t 
depend on player I’s action, since player 2’s information set contains both actions. Thus, a deter¬ 
ministic strategy 02 for player 2 in G just plays an action in {0,1}; the corresponding strategy 
F{o 2 ) just plays the same string. UG4(b) holds trivially in this case. To define F{oi) for a strat¬ 
egy oi for player 1, we need to show how to implement each action of player 1. To play b at the 
empty history in Gn, 1 plays the commitment string Gi(l”',6 ,r), where r is the randomness used 
by player 1 in the computation (which is then saved as the TM’s state). To play the action “open”, 
it computes k = G2(l”,6 ,r); to play “destroy”, it plays A: © 1 (a string other than the right key). 
It is easy to see that UG4(b) holds for strategies of player 1. Moreover, it is easy to see that F{o) 
corresponds to 0 , so UG4(a) holds. We extend F to mixed strategies as described above. 

To see that UG4(c) holds, observe that a strategy for player 1 in Gn can clearly be mapped 
to a strategy in G: At the empty history player 1 has some distribution over commitments to 0 
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and commitments to 1. This clearly maps to a distribution over putting 0 and 1 in the envelope. 
At the other nodes where player 1 moves, Gn induces a distribution over correctly revealing the 
commitment or doing some other action; again, this clearly maps to a distribution over “open” and 
“destroy” in the obvious way. Since a strategy M[ for player 1 in ^ induces, for all n, a strategy M[ ^ 
for player 1 in Gn, we can associate a sequence {a[,a 2 , ■ ■ ■) with M(. It is easy to check that, for all 
strategies <72 for player 2 in G, is computationally indistinguishable from n 2 )^n- 

We similarly want to associate with each strategy for player 2 in ^ a sequence of strategies 
in G. This is a little more delicate, since the information structure in Gn is not the same as that 
in G. Given a strategy ui for player 1 in G, and an arbitrary polynomial-time strategy M2 for 
player 2 in Q, let Pn{b) be the probability that M 2 plays b when (W(cri),M2) is played in Gn- 
Let a'n be the strategy in G that plays according to the same distribution. We now claim that 
{‘^(^(0-1) M2)^” indistinguishable from }n- Assume, by way of contradiction, that it is not. 

This can happen only if, for infinitely many n, M 2 plays 0 and 1 with non-negligibly different 
probabilities, depending on whether it is faced with a commitment to 0 or a commitment to 1. 
But that means that, for infinitely many n, it can distinguish those two events with non-negligible 
probability. This contradicts the assumption that the commitment scheme is secure. □ 

3.3 Consistent partition structnres 

In this section, we discuss the connection between computational indistinguishability and informa¬ 
tion structure in games. As we saw, when going from the game G in Figure to the game Q that 
represents it, we replaced the information set in G (the use of an envelope) with computational in¬ 
distinguishability (a commitment scheme). Although the games in Q are perfect information games, 
so that the players have complete information about a history, if player 1 uses the commitment 
scheme appropriately, then player 2 does not really understand the “meaning” of a history (i.e., 
whether it represents a commitment to 0 or a commitment to 1). On the other hand, if player 
1 “cheats” by using, for example, some low-entropy random string for the commitment, player 2 
might have a strategy that is able to understand the “meaning” of its action. Thus, there is a sense 
in which the information structure of a computational game depends on the strategies of the play¬ 
ers. This dependence on strategies does not exist in standard games. If each of two histories h and 
h' in some information set I for player i has a positive probability of being reached by a particular 
strategy profile, then when player i is in I, he will not know which of h or h' was played, even if he 
knows exactly what strategies are being played. The situation is different for computational games, 
in a way we now make precise. 

Suppose that Q = {Gi,G 2 , ■ ■ ■) (/, J^)-represents G and /i is a history of G, so that fn^{h) is 
the set of histories of Gn that are mapped to /i by /„. For a set H of histories of a game G Q, 
let Vn{H) be the set of views that a player can have at histories in H when Gn is played. For a 
strategy profile M in Q, let ^^"(n) be the probability of reaching view v G Vn{H) if the players 
play strategy profile M in Gn- For a set V of views, let ^^[V) = For a set V of 

mutually incompatible views (i.e., a set V of views such that for all distinct views v,v' G V, the 
probability of reaching v given that v' is reached is 0, and vice versa), let ^ be a probability 

iGn 

distribution on V such that ^^„(^) = .y. if > 0; otherwise. Let C^(5') denote 

the probability of reaching a set S of histories in G if the players play strategy profile a. Note that 
if ^g{S) > 0, then by UG4, for all sufficiently large n, we must have iVn{fn^{S))) > 0- 

Definition 3.5. Let Q {f, P)-represent a game G and let M be a strategy in Q- A partition Xi of 

(recall that this is the set of histories in G where i plays) is M-consistent for player i if, for 
all non-singleton I ^Xi and all h € I such that both {Vn{fn^ (h))) and f,^{Vn{fn^{I \ h))) are 
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non-negligible, is computationally indistinguishable from ^ 

partition structure I is M-consistent if, for all agents i, X* is M-consistent. 

Intuitively, a partition Xj for player i is consistent with a strategy profile M, if, when M is 
played in Q, for all I € li and all histories h, h' G I, the distribution over views that map to h is 
computationally indistringuishable from the distribution over views that map to h'. In our example, 
this means that player 2 can’t distinguish between the distribution created by a commitment to 0 
and the distribution created by a commitment to 1 if the commitment algorithm is run “honestly” 
(using truly random strings). 

Note that we do not enforce any condition on histories in G that are mapped back to a set of 
histories that is reached with only negligible probability. This means there might be more than one 
M-consistent information partition. 

We next show that if X* is the information partition of player i in G, and Q (/, X')-represent G 
then for any strategy profile a in G, Xj must be X'(X)-consistent. 

Theorem 3.6. If Q {f, J-) -represents G, Xj is the information partition of player i in G, and a is 
a strategy profile in G then X* is X(a)-consistent. 


Proof. We must show that if / G Xj is a non-singleton information set for z in G and h ^ I , 
then for all strategy profiles a in G such that fg{h) > 0 and f,g{I \ {h}) > 0, is 

computationally indistinguishable from 

Assume, by way of contradiction, that /i G /, / is an information set for player i in G, and 
there exists a strategy profile cr in G that reaches both h and I\{h} with positive probability such 

that is distinguishable from Thus, there exists a distinguisher 

D for these distributions. Let a and a' be distinct actions in A{I). (Recall that we assumed that 
|A(/)| > 2.) Let M' be a strategy for player i in Q such that when M' reaches a history that maps 
to I (by UG4(b) and the fact that the sets of actions available in each information set are disjoint, 
this can be checked in polynomial time), M' uses D to distinguish if its view is in Vniffi^{h)) or 
Vniffi^{I \ {h})). M' then plays an action mapped to a if X> returns 0 and an action mapped to 
a' otherwise. At a history other than one in f~^{I), M' plays like X'(crj). It is easy to see that, 

because and are distinguishable with non-negligible probability, there 

is a non-negligible probability that the strategy M' is able to detect which case holds, and play 
accordingly. That means that when histories of {M',F{a-i)) are mapped to histories of G via /„, 
there is a non-negligible gap between the probability of (/i, o) and the probability of {h',a) for 
h' G I \ {h}. Since h G I, there can be no strategy a' for player i such that {a', U-i) has such a gap, 
and UG4(c) cannot hold. This gives us the desired contradiction. □ 


Note that Theorem 3.6 holds trivially if, for all Gi G Q, all the histories of Q that map to I 
are in the same information set in Gj. The theorem is of interest only when this is not the case. If 
we think of G as an abstract model of a computational game Q that represents it, this result can 
be thought of as saying that information sets in G can model both real lack of information and 
computational indistinguishability in Q. 


4 Solution Concepts for Computational Games 

In this section, we consider analogues of two standard solution concepts in the context of com¬ 
putational games: Nash equilibrium and sequential equilibrium, and prove that they exist if the 
computational game represents a finite extensive-form game. 
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4.1 Computational Nash equilibrium 

Informally, a strategy profile in ^ is a computational Nash equilibrium if no player i has a profitable 
polynomial-time deviation, where a deviation is taken to be profitable if it is profitable in infinitely 
many games in the sequence. Recall that is the distribution on the terminal histories in Gn 

induced by a strategy profile M in 

Definition 4.1. M = {Mi,..., Me} is a computational Nash equilibrium of a computable uniform 
sequence Q if, for all players i G [c] and for all polynomial-time strategies M{ in Q for player i, 
there exists a negligible function e, such that for all n, 

h&HT h&Hf 

Our definition of computational NE is similar in spirit to that of Dodis, Halevi, and Rabin [^, 
although they formalize it by having the strategies depend on a security parameter and the utilities 
depend only on actions in a single normal-form game (rather than a sequence of extensive-form 
games). Our definition (and theirs) differs from the standard definition of e-NE in two ways. First, 
we restrict to polynomial-time deviations. This seems in keeping with our focus on polynomial¬ 
time players. Second, we have a negligible loss of utility e in the definition, and e depends on 
the deviation. (The fact that e depends on the deviation means that what we are considering 
cannot be considered an e-Nash equilibrium in the standard sense.) Of course, we could have given 
a dehnition more in the spirit of the standard definition of Nash equilibrium by simply taking 
e to be 0. However, the resulting solution concept would simply not be very interesting, given 
our restriction to polynomial-time players. In general, there will not be a “best” polynomial-time 
strategy; for every polynomial-time TM, there may be another TM that is better and runs only 
slightly longer. For example, player 2 may be able to do a little better by spending a little more 
time trying to decrypt the commitment in a commitment scheme. (See also the examples in |^.) 

We now show that our model allows us to provide conditions that guarantee the existence of a 
computational NE; to the best of our knowledge, this has not been done before (and is mentioned 
as an open question in [^). More specifically, we show that if a computational game Q represents 
G, then for every NE a in G, there is a corresponding NE in Q. 

Theorem 4.2. If Q {f, IF)-represents G and a is a NE in G, then F{a) is a computational NE of 

G. 

Proof. Suppose that ci is a NE in G. By UG4, a corresponds to F{a). Thus, there exists some 
negligible function e such that, for all n, 

Y > Y -e{n). 

h&RT h&RT 

We claim that Mg is a computational NE of Q. Assume, by way of contradiction, that it is not. 
That means there is some player i, some strategy M[ for player i, and some constant c > 0 such 
that, for infinitely many values of n, 

heRT h&RT 

If not, we could have constructed a negligible function to satisfy the equilibrium condition. 
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By combining the two equation we get that for infinitely many values of n, 


> Y1 Pffih)ui{h) - e{n) + 
h&HT ’ h&HT 


1 


Since u is a NE, we get that for all sequences a'i,a '2 - ■ ■ of strategies for player i in G, 


h&HT 


p^{h)ui{h) > 


E PI 

h&HT 


G 


?-i) 


{h)ui{h). 


This means that for infinitely many values of n, and for any such sequence, 


E E - <n) +—. 

h&HT heHT 


But this contradicts UG4(c), which says that there must exist a sequence such that 

{4>?m /is computationally indistinguishable from {/??, ^ s}„. Since the difference between 
the two payoffs is not negligible, a distinguisher could just sample enough outcomes of these strate¬ 
gies and compute the average payoff to distinguish the two distributions with non-negligible prob¬ 
ability. Thus, Mff must be a computational NE of □ 


Theorem 4.2 shows that every NE in G has a corresponding NE in Q. The converse does not 
hold. This should not be surprising; the set of strategies in Q is much richer than that in G. The 
following example gives a simple illustration. 

Example 4.3. Consider the 2-player game G' that is like the game in Figure except that the 
payoff is 1 to both if they match and 0 otherwise (and both get —1 if player 1 does not open the 
envelope). This game has three NE: both play 0; both play 1; and both play the mixed strategy that 
gives probability 1/2 to each of 0 and 1. There is a computational game G' that represents G' that 


is essentially identical to the game G described in Section 3.2, except that the payoffs are modified 


appropriately. The game G' has many more equilibria than G', since player 1 can commit to 0 and 
1 with 0.5 probability but use a fixed key that the second player knows (or choose a random key 
from a low entropy set that the second player can enumerate). Player 2 can take advantage of this 
to always play the matching action. There is no strategy in G' that can mimic this behavior. 


4.2 Computational sequential equilibrium 

Our goal is to define a notion of computational sequential equilibrium. To do so, it is useful to 
think about the standard definition of sequential equilibrium at an abstract level. Essentially, a is 
a sequential equilibrium if, for each player i, there is a partition of the histories where i plays 
such that, at each cell I G player i has beliefs about the likelihood of being at each history 
in I, and the action that he chooses at a history in I according to cjj is a best response, given 
these beliefs and what the other agents are doing (i.e., a-i). The standard definition of sequential 
equilibrium takes the partition X' to consist of Ps information sets. If we partition the histories into 
singletons, we get a subgame-perfect equilibrium |13|. As we argued in Section 3.3, the information 


sets sets in G are too fine, in general, to capture a player’s ability to distinguish. Thus, as a first step 
to getting a notion of computational sequential equilibrium, we generalize the standard definition 
of sequential equilibrium in a straightforward way to get X-sequential equilibrium, where Xj is an 
arbitrary partition of the histories where i plays. 
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Definition 4.4. Given a partition I, a is a X-sequential equilibrium of G if there exists a sequence 
of completely mixed strategy profiles ... converging to a and a sequence 81 , 62 , ■■ ■ of nonneg¬ 

ative real numbers converging to 0 such that, for each player i and each set I G li, af is a 6 n-best 
response to conditional on having reached I. 


What are reasonable partition structures to use when considering a computational game? As 
we suggested, using the information partition structure of Q seems unreasonable. For example, 
in our example commitment game, this does not allow the second player to act the same when 
facing commitments to 0 and commitments to 1, although, as we argued earlier, if player 1 plays 
appropriately, a computationally bounded player cannot distinguish these two events. 

It seems reasonable to have histories in the same cell of the partition if the player cannot 
distinguish what these histories actually “represent”. For general uniform computable sequences it 
is unclear what “represents” should mean. However, if Q represents a game G, then we do have in 
some sense a representation for a history: the history it maps to in the underlying game. As we saw 
in Section 3.3, what a player can infer from a history might depend not just on the information 
partition structure of the games in Q, but also on the strategies played by the players in G. Thus, 
a natural candidate for a partition structure I when M is the strategy profile played is a partition 
that is based on an M-consistent partition structure Iq of the histories of G. We now formalize 
this intuition. 

Suppose that G (/, X')-represents G. Given a set / C H, let Ig„ be the set consisting of histories 
h G Gn such that fnih) G I. Given two strategies M and M' for a player in Q, let (M, I, M') be the 
TM that plays like M in Gn up to Ig„, and then switches to playing M' from that point on. For 
a game Gn G Q, a strategy profile M, and a set of histories in Gn that is reached with positive 
probability when M is played, let (f " , be the probability on terminal histories in G induced by 

pushing forward the probability on terminal histories in Gn conditioned on reaching (where we 
identify the event “reaching with the set of terminal histories that extend a history in 
We can similarly define Pg jji for a subset H' of histories in G. 


Definition 4.5. Suppose that Q (/, J^)-represents G. Then M = {Mi ,..., Me} is a computational 
sequential equilibrium of Q if there exists a sequence of completely mixed strategies 
converging to M and a sequence 81 , 82 , ■■■ converging to 0 such that, for all k, n, and players 
i G [c], there exists an M-consistent partition Xj such that, for all sets I G li and all polynomial¬ 
time strategies M' for player i in Q, there exists a negligible function e such that 


E 

h&HT 




E- 

heHT 




{h)ui{h) - e{n) - 8k. 


We now claim that, as with NE, if a is a sequential equilibrium of an extensive form game G 
with perfect recall and Q (/, X')-represents G, then T{a) is a computational sequential equilibrium 
of g. 

Theorem 4.6. Suppose that Q {f, T)-represents G and G has perfect recall. If there exists a belief 
function p such that {a, p) is a sequential equilibrium in G, then F{a) is a computational sequential 
equilibrium of Q. 

Proof. Suppose that there exists a belief system p such that {a, p) is a sequential equilibrium in 
G. Thus, there exists a sequence of completely mixed strategy profiles 0 ^, 5 "^,... that converges to 
a and a sequence (5i, 82 ,... that converges to 0 such that for all players i, all information sets I for 
i in G, and all strategies a' for i that act like a on all prefixes of histories in I, we have that 

P%j{h)ui{h) > Y - 4 - ( 1 ) 

h&RT h&RT 
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Assume, by way of contradiction, that M = J-{a) is not a computational sequential equilibrium. 
Let Mf be the TM that acts like except that at a view it is called to play, with probability 

2 ^ (which is negligible), it plays an arbitrary legal action, chosen uniformly at random. Note that 


this makes completely mixed, while ensuring that still corresponds to . Also note that 
the sequence converges to M. By Theorem 3.6, if li is the information partition of 


player i in G, then Xj is M^-consistent for all k, and, in particular, is also M-consistent. Since M is 
not a computational sequential equilibrium, there must be some k, player i, information set I for i 
in G, strategy for i, and constant c such that, for infinitely many values of n, 


heHT 


G„ 


{h)ui{h) > 


E 

h&HT 




{h)ui{h) H—- + 5k- 




( 2 ) 


Since is completely mixed, every terminal history is reached with positive probability. Thus, 
/g„ is reached with positive probability. Since corresponds to cj^, {4\^k r conditional 

ensemble) must be statistically close to {p^k /}n) for otherwise we could use the distinguisher 
for these ensembles to distinguish the unconditional ensembles. It follows that there exists some 
negligible function e such that, for all n. 


{h)ui{h) > Y P%,iih)ui{h) - e(n). 
h&HT ’ h&HT 


From and ([^, it follows that, for infinitely many values of n. 


E^ 

h&HT 




{h)ui{h) > 


h&RT 


e(n) + 


1 


+ ^k- 


(3) 


(4) 


By UG4(c), there is a sequence (t(, ct^, ... of strategies for f in G such that )}n is 

computationally indistinguishable from {p9, An- Since, for n sufficiently large, Ig„ is reached 

i/ 

with non-negligible probability by M^, and {M^, I, M') acts like Mf in all prefixes of histories 
in /g„, it must be the case that for n sufficiently large, ,/, M'), MA) reaches Ig„ with non- 
negligible probability. Moreover, ^k \ j }n is computationally indistinguishable from 

{p9, ^k -I rjn- If not, again, a distinguisher for the unconditional distributions can just use the 

distinguisher for the conditional distribution by calling it only when the sampled history is such 
that I is visited. From Q and Q, we get that for infinitely many values of n. 




h&RT 




{h)ui{h) > 




^ Pi 

h£RT 


G 


U)j 


{h)ui{h){h)ui{h) - e(n) + 


rr 


But, as in previous arguments, this contradicts the assumption that {(jP' 

putationally indistinguishable from {/3^ 
rium of Q. 


}n is com- 


k j}n- Thus, Mg is a computational sequential equilib- 

— iM 

□ 


What are the beliefs represented by this equilibrium? The beliefs we get are such that the 
players believe that, except with negligible probability, only strategies that are mappings (via F) 
of strategies in the underlying game were used, so they explain deviations in the computational 
game in terms of deviations in the underlying game. 
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One consequence of using completely mixed strategies in the standard setting is that a player 
always assigns positive probability to wherever he may find himself. In our setting, while we also 
require strategies to be completely mixed, a player i may still find himself in a situation (i.e., may 
have a view) to which he ascribes probability 0, so he knows his beliefs are bound to be incorrect. 
This can happen only if the randomness in i’s state is inconsistent with the moves that i made 
that led to the current view. (This can happen if, for example, i ignored the random string when 
computing the commitment string, and just outputted a string of all I’s.) While i may ascribe 
probability 0 to his earlier moves, deviations by other players always result in views to which i 
ascribes positive probability, so such deviations can not be used as signals or threats. 

By considering a consistent partitions here, we effectively average the expected payoff over all 
histories of Qn that map to the same information set in I. Note that, for each specific history in 
this set, there might be a better TM. For example, in the commitment game discussed before, for 
each commitment string, there is a TM for player 2 that does better then the prescribed protocol: 
the one that plays the right value given that string. However, our notion considers the expected 
value over all these histories, and thus a good deviation does not exist. Since no polynomial-time 
TM can tell to which histories in the underlying game these histories are mapped (via /), we treat 
cells in a consistent partition just as traditional information sets are treated in the standard notion 
of sequential equilibrium. 

5 Application: Implementing a Correlated Equilibrium Without 
a Mediator 

In this section, we show that our approach can help us analyze protocols that use cryptography 
to implement a correlated equilibrium (CE) in a normal-form game. Dodis, Halevi, and Rabin 
(DHR) were the first to use cryptographic techniques to implement a CE. They did so using a 
protocol that they showed was a NE, provided that players are computationally bounded (for a 
notion of computational NE that is related to ours). However, as discussed by Gradwohl, Livne, 
and Rosen (GLR), DHR’s proposed protocol does not satisfy solution concepts that also require 
some sort of sequential rationality. DHR’s protocol punishes deviations using a minimax strategy 
that may give the punisher as well as the player being punished a worse payoff; thus, it is just 
an empty threat. To deal with this issue, GLR introduce a solution concept that they call Threat 
Free Equilibrium (TFE), which explicitly eliminates such empty threats. GLR additionally provide 
a protocol that can implement a CE in a normal-form game that is a convex combination of NEs 
(GONE), without using a mediator; the GLR protocol is a TFE if the players are computationally 
bounded. 

We now provide a protocol similar in spirit to the one used in GLR that implements a CCNE; 
our protocol is a computational sequential equilibrium if the players are computationally bounded. 
Unlike GLR, we are able to apply our approach to CEs in games with more than 2 players, as 
well as being able to implement CCNEs that are not Pareto optimal. One more advantage of our 
approach is that since we allow the underlying game to be one of imperfect information, there is 
a natural way to model a normal-form game (where players are assumed to move simultaneously) 
as an extensive-form game: players just move sequentially without learning what the other player 
does. Since GLR’s results apply only to games of perfect information, they had to argue that they 
could extend their result to normal-form games. 

We require that the CGNE is of finite support, that all its coefficients are rational numbers, 
and that each of the NEs in its support has coefficients that are rational numbersj^We call such 
GCNEs nice. Note that any CCNE can be approximated to arbitrary accuracy by a nice CCNE. 

®GLR also made these assumptions. In fact, they required a slightly stronger condition; they required all the 
coefficients to be rational numbers whose denominator is a power of two. 
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Figure 2: An example of the game Gcorr where i = 2 and G is a coordination game 


Given a normal-form game G with a nice GONE vr, we show how to convert it to an extensive- 
form game Gcorr that implements this GE without using cryptography, but using envelopes; that 
is, Gcorr has a sequential equilibrium with the same distribution over outcomes in G as vr. We then 
show how to implement Gcorr as a computational game using a cryptographic protocol. 

Given G and vr, let i be the least common denominator of the coefficients of vr. Let Gcorr be 
the game where player 1 first puts an element of {0 ,— 1} in an envelope, then player 2 plays 
an element in {0, — 1} without knowing what player 1 played (all the histories where player 2 

makes his first move are in the same information set of player 2). Then player 1 can either open the 
envelope or destroy it. All the histories after player 1 opens the envelope form singleton information 
sets for the other players; all histories after player 1 destroys the envelope and 2 initially played 
j are in the same information set for the players other than 1, for j G {0, ...,£ — 1}. Then G is 
played. (Note that G might involve many players other than 1 and 2, but 1 and 2 are the only 
players who play in the initial part of Gcorr-) The players move sequentially: first player 2 moves, 
then player 1 moves (without knowing player 2’s move), then player 3 moves (without knowing 1 
and 2’s moves), and so on. The payoffs of Gcorr depend only on the players’ moves when playing 
the G component of Gcorr, and are the same as the payoffs in G. See Eigurej^for a game Gcorr 
when £ is 2 and G is a coordination game: that is, in G, each player moves either left or right, and 
each gets a payoff of 1 if they make the same move, and -1 if they make different moves. 

Let cr be a NE in G in which player I’s payoff is no better than it is in any other NE in G. 
Now consider the following simple strategies for the players in Gcorr- Intuitively, the players start 
by picking a NE in the support of vr to play, with probability proportional to its coefficient in vr. 
To this end, fix an ordering of length i of the NEs in the support of vr, where each NE appears 
a number of times proportional to its weight in the convex combination that makes up vr. At the 
empty history, player 1 selects an action a uniformly at random from {0, 1} and puts it in 

the envelope. Then player 2 also selects an action b uniformly at random from {0, Then 

player 1 opens the envelope. The players then play the NE in place {a + b mod i) in the ordering 
of NEs. If player 1 does not open, the players play according to a. Gall the resulting strategy profile 
a-jT- It is not hard to verify that implements vr, and that there exists a probability measure /v 
such that (utt) fJ-) is a sequential equilibrium of Gcorr- Defining // is easy: the only information sets 
not reached with positive probability (and hence ^ is determined) are the one where “destroy” is 
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played. At that point, the players’ play a, so they are best responding to each other, no matter 
what their beliefs are. 

So now all we have to provide is a computational game Qcorr that represents Gcorr, where the 
games in Qcorr use cryptography instead an envelope for the first part of the game. Let d be such 
that 2'^~^ < £ < 2'^. Let Qcorr be the sequence where Gn is the game where, at the empty history, 
player 1 commits to a d-bit string by using d commitments in parallel, each with key length n — 1 
and outputs the d commitment strings as his action. Player 2 then plays a bitstring of length d 
that can be viewed as a binary representation of a number in {0, Player 1 then plays a 

string that is intended to be the commitment keys of the d commitments. Then the players play a 
string representing their action in G (again using its binary representation). The utility are then 
given by the utility functions in G. 

We now claim that Qcorr represents Gcorr- 

Theorem 5.1. Qcorr represents Gcorr- 

Proof. It is obvious that Qcorr is a computable uniform sequence. We now show that it represents 
Gcorr- The mappings / of histories maps player I’s commitments to a string s to the action s 
mod i. (Notice that the fact we used d commitments in parallel does not change the fact that the 
commitments are perfectly binding and thus this is well defined.) Actions of player 2 are mapped 
to an action s mod I according to their binary representation; if player 1 reveals d valid keys in h, 
then in /n(/i) he plays “open”, and otherwise he plays “destroy”; the actions of G are mapped in 
the obvious way. 

To show that UG4 holds, we proceed as follows; The mapping T for a player j other than 1 and 
2 is obvious: It is easy to compute using the TM R of the commitment scheme if the commitments 
were opened successfully or not, so j can compute at which information set of Gcorr he is at 
(given his view), and play the binary representation of the action that the strategy plays at that 
information set. For player 2, note that player 2’s first action in Gcorr can’t depend on player I’s 
action, since player 2’s information set contains all the histories. Thus, a deterministic strategy <72 
for player 2 in Gcorr just plays an action in {0, ...,£ — 1}; T'(cj 2 ) just plays the same action at player 
2’s first information set in Qcorr- Similarly to the other players, T'((T 2 ) also plays the same action in 
G as (T 2 when player 2 is called upon to play again. Given a deterministic strategy ai for player 1, 
if fJi plays a at the first step in Qcorr, chooses uniformly at random one of the d-bit strings 

such that s = a mod i (there are at most 2 such strings), and plays the commitments strings 
(71(1”, si,ri),... ,(7rf(l”, Sd,rd), where r = ri|| ... \\rd is the prefix of the random tape representing 
the randomness used to compute the commitment strings. To play the action “open”, it computes 
ki = (72(1”, Si, ri) and play ki\\ ... \\kd; to play “destroy”, it plays /ci|| ... ||/crf©l (a string other than 
the right keys). Again, it is obvious how player 1 plays in G. It is easy to see that F{(t) corresponds 
to a, so UG4(a) holds. UG4(b) holds for all players trivially given these strategies. 

It is also obvious that UG4(c) holds for player 1 . Since the information structure it faces at 
Qcorr and Gcorr is essentially the same, anything it can do in Qcorr can be done by a strategy in 
Gccrrr by just looking at the distribution of actions in histories that map to each information set. 

The other players have different information structures in Qcorr and Gcorr, since they see the 
commitment strings in Qcorr- We discuss UG4(c) for player 2 here; the argument in the case of 
the others is similar (and simpler). Let a* for i 7 ^: 2 be a strategy for player i in Gcorr, and let 
Mi = R{ai). Let M' be an arbitrary polynomial time strategy for player 2 in Qcorr, and let D” be 
the distribution M'’s first action in Gn', let distribution over the actions of M' in G 

given that the commitment was opened successfully, player 1 committed to j, and player 2 ’s first 
move was w, and let D” be the distribution over the actions of M' in Gn if the commitment is 
not opened successfully and player 2’s first move was w. Let (t(j be a strategy in Gcorr for player 
2 that plays according to these distributions. We claim that )}n is indistinguishable 

from 
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G 1 

Let M ) distribution over histories ending at the first action of player 2 when 

(Ml, M',..., Me) is played in Gn and mapped using /„ to histories of Gcorr, and let ^ ) 

be the distribution over partial histories ending at the first action of player 2 when (cji, cr(j,..., Uc) 
is played in Gcorr- We first claim that ^ indistinguishable from ^ )}n- 

Assume, by way of contradiction, that it is not. This can happen only if, for infinitely many n, M' 
plays some action a with probabilities that differ non-negligibly, depending on whether it is faced 
with a commitment to different strings s or s'. But that means that for infinitely many n, it can 
distinguish those two events with non-negligible probability. This contradicts the assumption that 
the commitment scheme is secure. (Note that it is easy to show that, because a single commitment 
has the hiding property, then even when d such commitments are run in parallel, no polynomial-time 
TM should be able to distinguish between commitments to s and s'.) 

It is easy to see that this also means that the distribution over partial histories just before 
player 2 plays again are also indistinguishable. Now if the commitment is opened successfully, then 
the information structure player 2 faces in Qcorr is the same as in Gcorr, and thus the statement 
is obviously true. If the commitments were not opened, than by using a argument similar to that 
used for player 2’s first action, we can argue that if the distributions over partial histories just after 
player 2 plays again are not indistinguishable, then again we can use that as a distinguisher for the 
commitment scheme. □ 


By Theorems 4.6 and 5.1 since (with the appropriate beliefs) is a sequential equilibrium of 


Gcorr, is a computational sequential equilibrium of Qc 


6 Conclusion 

The model introduced in this paper is a first step towards a better understanding of polynomially 
bounded players playing finite games. We defined a sense in which a sequence G of games represents 
a single underlying game G, gave a novel definition of a computational sequential equilibrium, 
and provided conditions under which a computational sequential equilibrium (and hence also a 
computational NE) exists in G- Moreover, the model allows us to separate the cryptographic analysis 
from the strategic analysis. We show how we can use our model and definitions to analyze complex 
cryptographic protocols in a way that captures our intuitions about the rational behavior of the 
players in those protocols. 

An important next step is to refine the model so it can capture more complex cryptographic 
protocols. For example, some cryptographic protocols do not have a unique map between histories 
and actions (e.g., a computationally binding commitment can map a string to both 0 or 1 depending 
on the key). They also might have abstract actions that are hard to compute (for instance, there 
might be strings that are not valid commitments at all but it might be hard to compute them), 
or require a few implementation steps to implement one abstract step. One possible direction is to 
map a history and the TMs’ views into histories in the game. While this might solve some of the 
issues raised, it also introduces new challenges, which we intend to investigate. 

While in this paper we focus only on computationally bounded players represented by 
polynomial-time TMs (which seems most appropriate for the cryptographic applications we have 
in mind), we believe that our approach of relating a sequence of games to a single underlying game, 
and capturing computational indisitingushability with the information structure of this game can 
be applied to other models of computations with the appropriate adaptation of computational 
indisitingushability. 
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